The vulnerability originates from an infinite loop in the BigInteger.modInverse() method of the node‑forge library. When modInverse() is called with a zero value, the Extended Euclidean Algorithm enters a state with no exit condition, causing the process to hang and consume 100% CPU. The loop never terminates, thus the affected process becomes unresponsive and the application or host suffers a denial of service.

This defect affects installations of the DigitalBazaar Forge (node‑forge) library prior to version 1.4.0. Any Node.js project that relies on older releases of this JavaScript TLS implementation—including applications running on Windows, Linux, or macOS—is potentially exposed.

The vulnerability has a CVSS score of 7.5, indicating a high impact if exploited. The EPSS score is less than 1 %, pointing to a low likelihood of widespread exploitation, and it is not listed in the CISA KEV catalog. The attack vector is inferred to be local or remote depending on whether the offending cryptographic operation can be triggered by untrusted input; an adversary could cause the DoS by requesting node‑forge to compute a modular inverse of zero, which may occur through malicious payloads or misconfiguration.